Web Security Headers Checker

Scan HTTP security headers on any site, get an A+–F grade, and copy-paste fixes for Nginx, Apache & Cloudflare.

Web Security Headers Checker scans any website's HTTP security headers and gives you an instant A+ to F grade — the same methodology as securityheaders.com — right from Chrome's side panel or DevTools. What it checks: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — plus bonus checks for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and more. Beyond headers — exposed secret detection: Scans the response body for accidentally leaked API keys and credentials (Google API keys, AWS access keys, Stripe secret keys, GitHub tokens, Slack tokens, private key blocks, and more), with redacted previews and rotation guidance. Three ways to scan: • Auto-detect — one click scans your current tab, no typing needed • Live capture — reads the exact headers your browser received on page load • DevTools panel — analyzes the network log directly, including cookie-dependent responses For every issue found: Get copy-paste fix snippets for Nginx, Apache, and Cloudflare (Pages _headers and Transform Rules), plus a one-click Markdown export for audit reports and client deliverables. No account, no tracking, no data leaves your browser except the page you choose to scan. Built by Faiz Azizan — drfaizazizan.com